This page converts the high-level crosswalk into framework-specific annexes. The goal is not exhaustive certification language. The goal is to show where Protective Computing can be translated into recognizable governance, privacy, security, and assurance controls with explicit evidence hooks.
The consolidated annexes remain below for side-by-side comparison, but each framework now also has its own citation target page.
| Protective control | NIST PF function/category | Translation | Evidence hook |
|---|---|---|---|
| Exposure Minimization | Control-P / Data minimization, manageability | Protective Computing sharpens privacy-by-default into essential-only schema, bounded retention, and explicit egress review. | field ledger, retention policy table |
| Local Authority | Control-P / Individual participation, autonomy | Local authority operationalizes user agency by keeping the essential path available without continuous provider mediation. | local authority profile, offline parity and sync spec |
| Coercion Resistance | Govern-P / Risk tolerance, harmful disclosure analysis | The framework lacks explicit coercion design language; Protective Computing adds forced-disclosure and compelled-export boundaries. | coercion boundary matrix, scenario packet |
| Protective control | AI RMF function | Translation | Evidence hook |
|---|---|---|---|
| Threat boundaries | Map | Protective Computing can supply contextual harm boundaries for AI-assisted systems handling sensitive records or triage. | specification, threat models |
| Repeatable audits | Measure | Audit checklists, evidence packets, and CI gates provide a repeatable measurement substrate for risky system behaviors. | audit checklist, audit path |
| Operational governance | Govern / Manage | Protective Computing adds release-bound evidence and explicit negative claims to reduce unsafe overstatement. | reference packet, boundary page |
| Protective control | ISO 27001 control family | Translation | Evidence hook |
|---|---|---|---|
| No master keys / operator non-possession | Cryptography, access control | Protective Computing requires the operator boundary to be stated plainly instead of implied through general encryption claims. | PainTracker mapping, reference packet |
| Reversibility | Business continuity, integrity, change recovery | Reversibility adds user-facing undo, restore, and destructive-action boundedness to standard recoverability posture. | reversibility boundary table |
| Degraded Functionality | Availability and continuity | Protective Computing narrows availability to essential-path survival under constrained devices, bandwidth, and inputs. | degraded mode matrix, requirements checklist |
| Protective control | ISO 42001 concern | Translation | Evidence hook |
|---|---|---|---|
| Boundary clarity | AI system scope and intended use | Protective Computing contributes a negative-claims discipline so deployers state what the system is not safe for. | boundary page, reference packet |
| Human vulnerability controls | Lifecycle risk treatment | The discipline adds coercion, degraded infrastructure, and institutional pressure as governance-relevant failure conditions. | threat models, independent review |
| Protective control | Trust service criterion | Translation | Evidence hook |
|---|---|---|---|
| Exposure Minimization | Privacy / Confidentiality | Protective Computing makes confidentiality claims inspectable through per-field necessity and explicit retention windows. | compliance matrix, retention enforcement report |
| Degraded Functionality | Availability | Availability is reframed as essential workflow continuity rather than mere uptime. | offline parity, implementation spec |
| Essential Utility | Processing integrity / Governance | Essential utility questions whether incentive structures or optional features undermine reliable completion of the core task. | feature justification matrix, subtraction report |
| Protective control | ASVS area | Translation | Evidence hook |
|---|---|---|---|
| User-held keys / no backdoors | Cryptography / data protection | Protective Computing adds an explicit prohibition on administrative decrypt capability as a public claim boundary. | PainTracker mapping, duress checklist |
| Bounded egress | Communications / data protection | The discipline requires intent-linked egress and threat-aware disclosure review instead of generic transport security alone. | audit artifact draft, metadata retention policy |
| Coercion-safe limitations | Architecture / threat modeling | Protective Computing introduces a public requirement to document what the system cannot safely withstand under compulsion. | coercion scenario packet, reference packet |
These annexes are evidence-linked but still intentionally compact. The next maturity step is framework-specific reviewer validation and per-control change tracking as mappings evolve.